Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
-
submitted
14/05/2024, 04:01
General
-
Target
2024-05-14_8538bfe0218f2ce281e469b857ae0cbc_cryptolocker.exe
-
Size
48KB
-
MD5
8538bfe0218f2ce281e469b857ae0cbc
-
SHA1
19e957f1d6811c86d1b032c353713f2f30c1a9c1
-
SHA256
46c0a369640e5c21bee6ab24c80cc68016bb8884e5a6686f09a10ec22c38b0f4
-
SHA512
b3dc314929b099105345da0490711874141e75e78f8662ebd4ce8f0b9ca9b691be58aa33e497bcbd402526866202df55ab48e6e4dd61a44b634872ced3c6183c
-
SSDEEP
768:P6LsoVEeegiZPvEhHSP+gp/QtOOtEvwDpjBBMLZdzuqpXsiE8Wq/Dpkco:P6Q0ElP6G+gJQMOtEvwDpjB8WMlfo
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-14_8538bfe0218f2ce281e469b857ae0cbc_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-14_8538bfe0218f2ce281e469b857ae0cbc_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD5ed31ca20085bf6684d894963db44c28c
SHA1afe3b1e8a172305a3b2d07bfabb0e3122b5abc76
SHA256c2e0d5b5410ac1117674c5f9394148e294cf34f5500bf15397fb60ed228018e7
SHA512febefe886d266c60990654389da9bd596604d8a2a90ef1b3eea19b5100d6962d37c134de1aad38e5f3bfd70f451050ff6bc4f8212a1b6179bac3f3d3da92caf5
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB